High
CVE-2026-18442
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 14
Reset filters
High
CVE-2026-81286
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.1 - Unauthenticated SQL Injection
Medium
CVE-2026-83562
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-77701
WCFM Marketplace – Multivendor Marketplace for WooCommerce < 3.8.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Refund Request
Medium
CVE-2026-14196
WCFM Marketplace <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Store vendor+) Cross-Vendor Review Deletion and Status Update
Medium
CVE-2026-12126
WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'
Medium
CVE-2025-63029
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.7.2 - Authenticated (Store vendor+) SQL Injection
Medium
CVE-2026-1722
WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation
Medium
CVE-2025-64631
WCFM Marketplace <= 3.7.3 - Missing Authorization
Medium
CVE-2024-44009
WCFM Marketplace – Multivendor Marketplace for WooCommerce <= 3.6.11 - Reflected Cross-Site Scripting
Medium
CVE-2023-4960
WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2022-4935
WCFM Marketplace <= 3.4.11 - Missing Authorization
Medium
CVE-2022-4936
WCFM Marketplace <= 3.4.12 - Cross-Site Request Forgery
Critical
CVE-2021-24849
WCFM - WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.